Run zeekctl cron when cron-only zeekctl settings change

LogExpireInterval, StatsLogExpireInterval, CrashExpireInterval, MinDiskSpace
and MailHostUpDown are only acted on by ZeekControl's 'cron' command, which
nothing ever ran, so setting them in SOC had no effect.

Track those five in /opt/so/state/zeek/zeekctl_cron_settings and trigger the
cron run off that file, so unrelated edits like CompressLogs don't fire it.
Runs as the zeek user to avoid root-owned files under /nsm/zeek, with
--no-watch so the crashed-node watchdog doesn't race the container restart.

salt/zeek/config.sls

@@ -133,6 +133,20 @@ zeekctlcfg:
     - defaults:
         ZEEKCTL: {{ ZEEKMERGED.config.zeekctl | tojson }}
 
+# ZeekControl only acts on these five settings from its 'cron' command, so track them
+# separately from zeekctl.cfg. Changing CompressLogs or LogRotationInterval rewrites
+# zeekctl.cfg but must not trigger a cron run, so zeekctlcron watches this file instead.
+zeekctlcronsettings:
+  file.managed:
+    - name: /opt/so/state/zeek/zeekctl_cron_settings
+    - makedirs: True
+    - contents: |
+        LogExpireInterval={{ ZEEKMERGED.config.zeekctl.get('LogExpireInterval', '') }}
+        StatsLogExpireInterval={{ ZEEKMERGED.config.zeekctl.get('StatsLogExpireInterval', '') }}
+        CrashExpireInterval={{ ZEEKMERGED.config.zeekctl.get('CrashExpireInterval', '') }}
+        MinDiskSpace={{ ZEEKMERGED.config.zeekctl.get('MinDiskSpace', '') }}
+        MailHostUpDown={{ ZEEKMERGED.config.zeekctl.get('MailHostUpDown', '') }}
+
 # Sync node.cfg
 nodecfg:
   file.managed:

salt/zeek/enabled.sls

@@ -71,6 +71,25 @@ so-zeek:
       - file: zeekctlcfg
       - file: zeekbpf
 
+# LogExpireInterval, StatsLogExpireInterval, CrashExpireInterval, MinDiskSpace and
+# MailHostUpDown stay inert until 'zeekctl cron' runs, so run it once whenever one of
+# them changes. --no-watch skips ZeekControl's crashed-node watchdog, which would
+# otherwise race the container restart that the same config change triggers, and which
+# would duplicate the healthcheck beacon in salt/_beacons/zeek.py. The retry covers the
+# startup deploy still holding the ZeekControl lock. Run as the zeek user, as
+# salt/_modules/zeekctl.py does, so the stats logs and zeekctl-config.sh this writes stay
+# owned by uid 937 rather than root.
+zeekctlcron:
+  cmd.run:
+    - name: docker exec so-zeek runuser -l zeek -c '/opt/zeek/bin/zeekctl cron --no-watch'
+    - onchanges:
+      - file: zeekctlcronsettings
+    - require:
+      - docker_container: so-zeek
+    - retry:
+        attempts: 5
+        interval: 30
+
 delete_so-zeek_so-status.disabled:
   file.uncomment:
     - name: /opt/so/conf/so-status/so-status.conf

salt/zeek/soc_zeek.yaml

@@ -58,6 +58,26 @@ zeek:
       CompressLogs:
         description: This setting enables compression of Zeek logs. If you are seeing packet loss at the top of the hour in Zeek or PCAP you might need to disable this by seting it to 0. This will use more disk space but save IO and CPU.
         helpLink: zeek
+      LogExpireInterval:
+        description: Number of days to keep rotated Zeek logs in /nsm/zeek/logs, or 0 to keep them forever. Saving this setting runs "zeekctl cron", which deletes any logs already older than the value you set. Note that this is a one time cleanup rather than a rolling retention policy, so logs that age past the interval afterwards are not removed until this setting is changed again. Ongoing cleanup based on disk usage is handled separately by so-sensor-clean.
+        helpLink: zeek
+        advanced: True
+      StatsLogExpireInterval:
+        description: Number of days to keep entries in the Zeek stats log, or 0 to keep them forever. Saving this setting runs "zeekctl cron", which applies the new value once. See LogExpireInterval for details on this behavior.
+        helpLink: zeek
+        advanced: True
+      CrashExpireInterval:
+        description: Number of days to keep Zeek crash directories, or 0 to keep them forever. Saving this setting runs "zeekctl cron", which applies the new value once. See LogExpireInterval for details on this behavior.
+        helpLink: zeek
+        advanced: True
+      MinDiskSpace:
+        description: Percentage of free disk space below which ZeekControl reports a warning, or 0 to disable the check. This check only runs during "zeekctl cron", which Security Onion runs when you save this setting. It does not delete anything.
+        helpLink: zeek
+        advanced: True
+      MailHostUpDown:
+        description: Set to 1 to send mail when a Zeek node changes between the up and down states. This check only runs during "zeekctl cron", which Security Onion runs when you save this setting, so it is not a continuous monitor. Requires MailTo to be set to a working address.
+        helpLink: zeek
+        advanced: True
   policy:
     custom:
       filters: